unlink segfaults on 2.6.14
Status: Beta
Brought to you by:
qiq
Menu
▾
▴
#43 unlink segfaults on 2.6.14
open
nobody
None
5
2005-10-31
2005-10-31
Anonymous
No
Modifying a file the first time works, modifying the
file again or removing a backup of the file segfaults.
Ive tried this through a terminal using joe, and joe
segfaults, using gedit causes gedit to lock up when i
try to save.
Example 1:
I open index.html and modify the file and save it in
joe, no errors.
Opening index.html again and modify and save causes a
segfault.
Example 2:
Open index.html and modify file in joe, no errors.
Removing the index.html~ backup file causes a segfault
but yet the file is removed.
shfs 0.35 works fine on 2.6.13, these problems started
happening on 2.6.14
Ive attached a couple of the segfault logs
Logged In: YES
user_id=1370928
I submitted this bug, didn't realize I wasn't logged in.
Logged In: YES
user_id=696399
I've got the same exact problem.
Logged In: NO
I've got a segfault too (linux 2.6.14) when i try to umount
and it crashes my box.
Here are the syslog :
Nov 2 06:13:32 srvweb kernel: ------------[ cut here
]------------
Nov 2 06:13:32 srvweb kernel: kernel BUG at fs/inode.c:260!
Nov 2 06:13:32 srvweb kernel: invalid operand: 0000 [#2]
Nov 2 06:13:32 srvweb kernel: Modules linked in: shfs
iptable_filter ip_tables dm_mod w83627hf hwmon_vid i2c_isa
i2c_core d
ummy ipv6 raid1 md_mod rtc
Nov 2 06:13:32 srvweb kernel: CPU: 0
Nov 2 06:13:32 srvweb kernel: EIP:
0060:[clear_inode+32/304] Not tainted VLI
Nov 2 06:13:32 srvweb kernel: EFLAGS: 00010202
(2.6.14-vs2.1.0-rc5)
Nov 2 06:13:32 srvweb kernel: EIP is at clear_inode+0x20/0x130
Nov 2 06:13:32 srvweb kernel: eax: 0000001a ebx: e32c4aac
ecx: 00000000 edx: e32c4aac
Nov 2 06:13:32 srvweb kernel: esi: e32c4aac edi: 00000080
ebp: c18deae0 esp: c1bc3e80
Nov 2 06:13:32 srvweb kernel: ds: 007b es: 007b ss: 0068
Nov 2 06:13:32 srvweb kernel: Process kswapd0 (pid: 148,
threadinfo=c1bc2000 task=c1b5f530)
Nov 2 06:13:32 srvweb kernel: Stack: e32c4aac f8ac36c0
e32c4aac c017cfb5 e32c4aac 00000000 00000000 e32c4aac
Nov 2 06:13:32 srvweb kernel: e32c4aac c017d213
e32c4aac c04b25e0 dfbf7228 c017a9e4 e32c4aac c01490c6
Nov 2 06:13:32 srvweb kernel: c1bc3ed8 c1bc3ed0
0005a168 00000000 00000081 c017addf 00000080 c014ddab
Nov 2 06:13:32 srvweb kernel: Call Trace:
Nov 2 06:13:32 srvweb kernel: [pg0+945780416/1068704768]
shfs_delete_inode+0x0/0x130 [shfs]
Nov 2 06:13:32 srvweb kernel:
[generic_delete_inode+133/288] generic_delete_inode+0x85/0x120
Nov 2 06:13:32 srvweb kernel: [iput+99/144] iput+0x63/0x90
Nov 2 06:13:32 srvweb kernel: [prune_dcache+276/368]
prune_dcache+0x114/0x170
Nov 2 06:13:32 srvweb kernel:
[throttle_vm_writeout+54/128] throttle_vm_writeout+0x36/0x80
Nov 2 06:13:32 srvweb kernel: [shrink_dcache_memory+31/80]
shrink_dcache_memory+0x1f/0x50
Nov 2 06:13:32 srvweb kernel: [shrink_slab+379/448]
shrink_slab+0x17b/0x1c0
Nov 2 06:13:32 srvweb kernel: [balance_pgdat+779/992]
balance_pgdat+0x30b/0x3e0
Nov 2 06:13:32 srvweb kernel: [kswapd+233/272]
kswapd+0xe9/0x110
Nov 2 06:13:32 srvweb kernel:
[autoremove_wake_function+0/96]
autoremove_wake_function+0x0/0x60
Nov 2 06:13:32 srvweb kernel: [ret_from_fork+6/20]
ret_from_fork+0x6/0x14
Nov 2 06:13:32 srvweb kernel:
[autoremove_wake_function+0/96]
autoremove_wake_function+0x0/0x60
Nov 2 06:13:32 srvweb kernel: [kswapd+0/272] kswapd+0x0/0x110
Nov 2 06:13:32 srvweb kernel: [kernel_thread_helper+5/12]
kernel_thread_helper+0x5/0xc
Nov 2 06:13:32 srvweb kernel: Code: e8 25 4b c0 eb c4 90 8d
74 26 00 56 53 83 ec 04 8b 5c 24 10 e8 a2 2b 21 00 89 1c 24 e8
4a 7f fe ff 8b 83 cc 00 00 00 85 c0 74 08 <0f> 0b 04 01 16
a6 3a c0 8b 83 34 01 00 00 a8 10 75 08 0f 0b 06
Nov 2 06:13:32 srvweb kernel: ------------[ cut here
]------------
pathome@pmenier.dynalias.net
Logged In: NO
same issues on umounting here too (linux-2.6.14-ck1).
from dmesg:
SHell File System, (c) 2002-2004 Miroslav Spousta
------------[ cut here ]------------
kernel BUG at fs/inode.c:252!
invalid operand: 0000 [#1]
PREEMPT
Modules linked in: shfs vmnet parport_pc parport vmmon smbfs
snd_pcm_oss snd_mixer_oss analog ns558 gameport pcspkr rtc
snd_intel8x0 snd_ac97_codec snd_ac97_bus snd_pcm snd_timer
snd snd_page_alloc i2c_sis96x i2c_core tsdev fglrx sis_agp
agpgart sis900
CPU: 0
EIP: 0060:[<c0177607>] Tainted: PF VLI
EFLAGS: 00010202 (2.6.14-magellan-r1)
EIP is at clear_inode+0x17/0x100
eax: 00000001 ebx: df179d34 ecx: df179d34 edx: df179d34
esi: e1d163e0 edi: c746e000 ebp: c746e000 esp: c746fee8
ds: 007b es: 007b ss: 0068
Process umount (pid: 30471, threadinfo=c746e000 task=d377c090)
Stack: df179d34 e1d163e0 c01786a5 df179d34 def8e800 df179d34
c01751cc df179d34
c746e000 c746e000 def8e800 d97ff400 e1d1f100 c746e000
c0164564 def8e800
d97ff48c def8e800 c746e000 00000011 00000001 c0165006
d97ff400 d97ff400
Call Trace:
[<e1d163e0>] shfs_delete_inode+0x0/0x100 [shfs]
[<c01786a5>] generic_delete_inode+0x85/0x160
[<c01751cc>] dput+0x18c/0x2d0
[<c0164564>] generic_shutdown_super+0x34/0x150
[<c0165006>] kill_anon_super+0x16/0x50
[<c0164448>] deactivate_super+0x58/0x80
[<c017abe4>] sys_umount+0x34/0x80
[<c0485391>] do_page_fault+0x111/0x686
[<c017ac3c>] sys_oldumount+0xc/0x10
[<c0102f4b>] sysenter_past_esp+0x54/0x79
Code: 49 89 0d 88 b2 5d c0 eb c5 8d 74 26 00 8d bc 27 00 00
00 00 56 53 8b 5c 24 0c 53 e8 d4 88 fe ff 58 8b 83 c8 00 00
00 85 c0 74 08 <0f> 0b fc 00 94 91 4a c0 8b 83 2c 01 00 00
a8 10 75 08 0f 0b fe
niro@magellan-linux.de
Logged In: NO
Same problem here :-(
Logged In: NO
Having the same on 2.6.14.2:
mount,
open file (evince file.pdf)
umount
=> segfault (umount not successfull)
=> oops:
SHell File System, (c) 2002-2004 Miroslav Spousta
------------[ cut here ]------------
kernel BUG at fs/inode.c:252!
invalid operand: 0000 [#1]
PREEMPT
Modules linked in: shfs nfs lockd sunrpc parport_pc lp
parport eth1394 snd_cmipci snd_opl3_lib snd_mpu401_uart
8139too mii ohci1394 ieee1394 emu10k1_gp gameport
snd_seq_midi snd_emu10k1_synth snd_emux_synth
snd_seq_virmidi snd_seq_midi_emul snd_pcm_oss snd_mixer_oss
snd_seq_oss snd_seq_midi_event snd_seq snd_emu10k1
snd_rawmidi snd_seq_device snd_ac97_codec snd_pcm snd_timer
snd_ac97_bus snd_page_alloc snd_util_mem snd_hwdep snd
soundcore sd_mod usb_storage scsi_mod nvidia evdev w83627hf
hwmon_vid hwmon i2c_isa i2c_viapro i2c_core 8250 serial_core
tun crc32 usbhid uhci_hcd ehci_hcd usbcore ide_cd cdrom e1000
CPU: 0
EIP: 0060:[<c0177dbb>] Tainted: P VLI
EFLAGS: 00010202 (2.6.14.2)
EIP is at clear_inode+0x1b/0x130
eax: 00000004 ebx: f57bf478 ecx: f57bf344 edx: f57bf478
esi: f8c52b40 edi: 00000019 ebp: f52d4000 esp: f52d5ec4
ds: 007b es: 007b ss: 0068
Process umount (pid: 10777, threadinfo=f52d4000 task=f505aa70)
Stack: f57bf478 f57bf478 f8c52b40 c0178fb8 f57bf478 c017929c
f57bf49c f56214d0
f57bf478 c0175e2e f57bf478 00000000 f52d5fbc f52d4000
f52d4000 f56b4448
f610b800 f8c5ae00 f52d4000 c0176358 0000005c f56b4448
c0162be7 f56b4448
Call Trace:
[<f8c52b40>] shfs_delete_inode+0x0/0x130 [shfs]
[<c0178fb8>] generic_delete_inode+0x98/0x170
[<c017929c>] iput+0x3c/0x90
[<c0175e2e>] prune_dcache+0x14e/0x260
[<c0176358>] shrink_dcache_parent+0x18/0x30
[<c0162be7>] generic_shutdown_super+0x27/0x170
[<c0163741>] kill_anon_super+0x21/0x60
[<c017af44>] free_vfsmnt+0x24/0x30
[<c0162aaa>] deactivate_super+0x5a/0x90
[<c017b8bf>] sys_umount+0x3f/0x90
[<c015af2a>] sys_close+0x6a/0xd0
[<c017b927>] sys_oldumount+0x17/0x20
[<c0102f25>] syscall_call+0x7/0xb
Code: 63 37 c0 ff 0d 68 74 3f c0 5b c3 90 8d 74 26 00 56 53
83 ec 04 8b 5c 24 10 89 1c 24 e8 9f 61 fe ff 8b 83 c8 00 00
00 85 c0 74 08 <0f> 0b fc 00 84 64 34 c0 8b 83 2c 01 00 00
a8 10 75 08 0f 0b fe
Logged In: NO
Same thing here:
Kernel BUG at fs/inode.c:252
invalid operand: 0000 [1]
CPU 0
Modules linked in: shfs(U) parport_pc lp parport autofs4
rfcomm l2cap bluetooth sunrpc pcmcia yenta_socket
rsrc_nonstatic pcmcia_core ipt_REJECT ipt_state ip_conntrack
nfnetlink iptable_filter ip_tables nls_utf8 ntfs(U) video
button battery ac ipv6 usblp ohci_hcd ehci_hcd i2c_nforce2
i2c_core shpchp snd_intel8x0 snd_ac97_codec snd_ac97_bus
snd_seq_dummy snd_seq_oss snd_seq_midi_event snd_seq
snd_seq_device snd_pcm_oss snd_mixer_oss snd_pcm snd_timer
snd soundcore snd_page_alloc forcedeth floppy dm_snapshot
dm_zero dm_mirror ext3 jbd dm_mod sata_nv libata sd_mod scsi_mod
Pid: 2936, comm: kate Not tainted 2.6.14-1.1637_FC4 #1
RIP: 0010:[<ffffffff8018e080>]
<ffffffff8018e080>{clear_inode+44}
RSP: 0018:ffff810021e55ea8 EFLAGS: 00010202
RAX: 0000000000000000 RBX: ffff810023c619a8 RCX:
ffff810023c61ca8
RDX: 0000000000000000 RSI: 00000000000000f8 RDI:
ffff810023c619a8
RBP: ffffffff882ed14e R08: 0000000000000000 R09:
0000000000000000
R10: 000000002fecce45 R11: ffffffff8018e6c1 R12:
ffff810023c619a8
R13: 0000000000000000 R14: ffff81003d6a8000 R15:
0000000000f8ecb0
FS: 00002aaaaaae7d80(0000) GS:ffffffff804f5800(0000)
knlGS:0000000000000000
CS: 0010 DS: 0000 ES: 0000 CR0: 000000008005003b
CR2: 00002aaaae409000 CR3: 0000000021e4c000 CR4:
00000000000006e0
Process kate (pid: 2936, threadinfo ffff810021e54000, task
ffff81002506d100)
Stack: ffff810023c619a8 ffffffff8018e795 0000000001066b60
ffff810023c67ac0
0000000001066b60 ffffffff80184a5c ffff8100247ca7f0
ffff81003f3a3c00
0000000892de7f9d ffff81003d6a802c
Call Trace:<ffffffff8018e795>{generic_delete_inode+212}
<ffffffff80184a5c>{sys_unlink+266}
<ffffffff80110d98>{syscall_trace_enter+217}
<ffffffff80110dd5>{syscall_trace_leave+55}
<ffffffff8010e7f0>{tracesys+113}
<ffffffff8010e850>{tracesys+209}
Code: 0f 0b 68 31 7b 35 80 c2 fc 00 48 8b 83 b8 02 00 00 a8
10 75
RIP <ffffffff8018e080>{clear_inode+44} RSP <ffff810021e55ea8>
Happening only after a kernel upgrade; worked fine before.
Same thing as above basically.
Logged In: YES
user_id=1321140
I found a workaround that eliminates the segfault, but I'm
not sure about the consequences, so don't blame me if your
system crashes...
Modify function shfs_delete_inode() in
shfs/Linux-2.6/inode.c like this:
------------------ cut ------------------
static void
shfs_delete_inode(struct inode *inode)
{
struct shfs_inode_info *i;
DEBUG("ino: %lu\n", inode->i_ino);
i = (struct shfs_inode_info *)inode->u.generic_ip;
if (!i) {
VERBOSE("invalid inode\n");
goto out;
}
if (i->cache) {
VERBOSE("file cache not free!\n");
/* TODO: free it now? */
}
KMEM_FREE("inode", inode_cache, i);
out:
inode->i_data.nrpages = 0; /* ADD THIS LINE */
clear_inode(inode);
}
------------------ cut ------------------